resource_url_from_server_url preserves explicit default ports
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 76/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- python
- Domain
- authentication, security
Research direction
Start at resource_url_from_server_url() in mcp.shared.auth_utils and reproduce the example with explicit default and non-default ports. Confirm that HTTP 80 and HTTPS 443 are removed while non-default ports remain, and verify that check_resource_allowed() accepts equivalent canonical resource URLs.
Written by the indexing model from the issue text.
Description
Initial checks
- I tested the current
mainbranch (6e30452). - I searched existing issues and pull requests for this behavior.
Description
resource_url_from_server_url() lowercases the scheme/authority and removes the fragment, but it preserves an explicitly specified default port. This makes an RFC 8707 resource URL such as https://example.com:443/mcp compare unequal to the equivalent https://example.com/mcp value used by Protected Resource Metadata.
RFC 3986 section 6.2.3 treats an explicit default port as equivalent to an omitted port. Pydantic also normalizes the metadata URL by dropping the default port. The SDK currently canonicalizes only one side, so check_resource_allowed() can reject an otherwise equivalent resource and abort OAuth resource validation.
Expected: HTTP port 80 and HTTPS port 443 are removed during canonicalization; non-default ports remain unchanged.
Example code
from mcp.shared.auth_utils import check_resource_allowed, resource_url_from_server_url
canonical = resource_url_from_server_url("https://example.com:443/mcp")
print(canonical) # current: https://example.com:443/mcp
print(check_resource_allowed(canonical, "https://example.com/mcp")) # current: False
Environment
- Python 3.12
- MCP Python SDK
mainat6e30452
I used AI assistance while investigating this issue and reviewed and reproduced the behavior locally.
- Dominant language
- Python
- Stars
- 24.3k
- Forks
- 4k
- Avg merge
- 1d 19m
- Merged PRs (30d)
- 29
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from modelcontextprotocol/python-sdk
-
v1 v2
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
modelcontextprotocol/python-sdk#3546 · 5 comments ·
-
v1 v2
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
modelcontextprotocol/python-sdk#3545 · 1 comment ·
-
v1 v2
Difficulty 1/5 Under an hour Newbie friendliness 91/100
modelcontextprotocol/python-sdk#3508 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
modelcontextprotocol/python-sdk#3504 ·
-
v1 v2
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
modelcontextprotocol/python-sdk#3492 · 1 comment ·
All issues in modelcontextprotocol/python-sdk
Similar issues
-
documentation help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
simonw/sqlite-utils#872 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100